coordigent 0.1.0 → 0.1.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Coordigent, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,26 +1,54 @@
 # Coordigent npm launcher
 
-Runs Coordigent's `coord` CLI from npm:
+Coordigent's `coord` CLI and `coord-mcp` MCP server, from npm:
 
 ```sh
-npx coordigent connect        # once, or:
-npm i -g coordigent && coordigent connect
+npm i -g coordigent
+coord connect
 ```
 
-(Not on npm yet: `package.json` stays `"private": true` until the trusted publisher is set up;
-see [Publishing](#publishing).)
+`npm i -g coordigent` puts three commands on `PATH`: `coord` runs `coord`, `coord-mcp` runs
+`coord-mcp`, and `coordigent` runs `coord` (or `coord-mcp` with `mcp` first, below). So every
+`coord …` command in the docs works as written. Without installing: `npx coordigent connect`.
+
+As an MCP server (stdio), for any MCP client, and the npm entry of the
+[MCP Registry listing](../../docs/operations.md#mcp-registry):
+
+```json
+{ "mcpServers": { "coordigent": { "command": "npx", "args": ["-y", "coordigent", "mcp"] } } }
+```
+
+`coord-mcp [args]`, and `coordigent mcp [args]`, run `coord-mcp [args]` after the same first-run
+download and checks. Everything the launcher prints goes to stderr, so stdout stays the MCP
+channel. `coord-mcp` reads the login from `~/.tower/config.json` (`npx coordigent login`) and the
+repo from the folder it starts in, or `COORDIGENT_REPO`.
 
 The package holds one Node file and no binaries. On first run it downloads `coord` and
 `coord-mcp` for this machine from the server's `/install/<artifact>`, checks each against the
 SHA-256 published in `/install/version`, and puts them where the installers do. After that, and on
-every later run, it runs `coord` with the same arguments and exits with its exit code. Because the
+every later run, it runs `coord` (or `coord-mcp`) with the same arguments and exits with its exit
+code. Because the
 binaries live where `install.sh` puts them, `coord update` and every MCP config keep working
 unchanged.
 
 - **Platforms:** macOS arm64 and x64 (an x64 Node under Rosetta gets the arm64 build), glibc Linux
   x64 and arm64, Windows x64. Anything else, and Alpine/musl, exits 1 before downloading.
 - **Where:** `~/.tower/bin`, or `%LOCALAPPDATA%\Coordigent\bin` on Windows (as `install.ps1`).
-  `TOWER_BIN_DIR` overrides both. The directory is not added to `PATH`; `coordigent <command>` is.
+  `TOWER_BIN_DIR` overrides both. The launcher never edits `PATH`: npm's global bin folder, already
+  on it, holds the `coord`, `coord-mcp` and `coordigent` commands, which run the binaries there.
+- **Which bin runs what:** each bin is its own file: `bin/coord.js` always runs `coord`,
+  `bin/coord-mcp.js` always runs `coord-mcp`, and `bin/coordigent.js` (the launcher itself) reads
+  `mcp` from its first argument. Not one file checking the name it was run as: on Windows npm's
+  `.cmd` shim runs `node <bin file>`, so the file is all that says which command was typed.
+- **Next to `install.sh`:** a `coord` from the installer (`~/.tower/bin`) and one from npm can
+  both be on `PATH`. Whichever comes first starts, and both run the same `~/.tower/bin/coord`, so
+  it does not matter which. An npm global prefix of `~/.tower` would link npm's `coord` into the
+  folder the binaries go in; the launcher refuses that with a message rather than run itself.
+- **Updating and removing:** `coord update` updates the binaries, as for any install;
+  `npm update -g coordigent` updates only this launcher. To remove everything, `coord uninstall`
+  first (binaries, hooks, `~/.tower`), then `npm rm -g coordigent`. Removing only the package
+  leaves the binaries in place, and running npm's `coord` after `coord uninstall` downloads them
+  again.
 - **Which server:** `COORDIGENT_SERVER_URL`, then `TOWER_SERVER_URL`, then the `serverUrl` saved in
   `~/.tower/config.json`, then `https://coordigent.com`: the order `coord` itself uses. A machine
   with no config yet gets one naming that server, with no token, as `install.sh` writes.
@@ -36,8 +64,11 @@ unchanged.
 
 Tests: `bun test packaging/npm` from the repo root (a local fake server stands in for
 `/install`). CI runs `npm pack --dry-run` on it (`.github/workflows/ci.yml`, job `npm-package`)
-and fails if the tarball holds anything but `bin/coordigent.js`, `README.md` and `package.json`,
-or gains an install-time script. Both that check and the release checks are
+and fails if the tarball holds anything but `bin/coordigent.js`, `bin/coord.js`, `bin/coord-mcp.js`,
+`LICENSE` (MIT), `README.md` and `package.json`, if `bin` does not map `coord`, `coord-mcp` and
+`coordigent` to those three files, if any of them is not executable, or if it gains an
+install-time script. The tests also pack the package and `npm i -g` the tarball into a scratch
+prefix, then run each linked command. Both that check and the release checks are
 `scripts/release-checks.js`, which is not shipped.
 
 ## Publishing
@@ -45,11 +76,13 @@ or gains an install-time script. Both that check and the release checks are
 `.github/workflows/publish-npm.yml` publishes on a tag `npm-v<version>` (the `v*` tags publish the
 container image and never touch npm), or by hand from Actions with an existing tag. It uses npm
 trusted publishing: no `NPM_TOKEN`; npm trades the job's GitHub OIDC token for a one-time
-credential, and `npm publish --provenance --access public` attaches a provenance statement. Before
+credential, and `npm publish --access public` publishes it (no provenance: npm only attests public source repos, and this repo is private). Before
 publishing, `scripts/release-checks.js release <tag>` refuses, with the reason, when:
 
 - the tag is not exactly `npm-v` plus `package.json`'s `version`;
 - the name is not `coordigent`;
+- `mcpName` is not `com.coordigent/coordigent`, which the MCP Registry reads from the published
+  version to accept the listing's npm entry;
 - `package.json` still has `"private": true`. It stays until the steps below are done, so
   until then every run of the workflow fails at that check and publishes nothing.
 
@@ -73,4 +106,6 @@ publishing, `scripts/release-checks.js release <tag>` refuses, with the reason,
    `git tag npm-v<version> <commit> && git push origin npm-v<version>`. The workflow publishes;
    the version page on npmjs.com then shows its provenance, linked to that run.
 
-Each later release: bump `version` in a PR, merge, push `npm-v<version>`.
+Each later release: bump `version` in a PR, merge, push `npm-v<version>`. Bump `version` and
+`packages[0].version` in the root `server.json` in the same PR (a test holds them equal), and
+after npm has published, publish the listing (docs/operations.md, "MCP Registry").

package/bin/coord-mcp.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+// `coord-mcp <args>` after `npm i -g coordigent`: the launcher, always running coord-mcp, the
+// stdio MCP server (bin/coordigent.js). Nothing but coord-mcp writes to stdout.
+"use strict";
+
+require("./coordigent.js").main(process.argv.slice(2), process.env, "coord-mcp");

package/bin/coord.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+// `coord <args>` after `npm i -g coordigent`: the launcher, always running coord
+// (bin/coordigent.js). Everything is passed through, `mcp` included.
+"use strict";
+
+require("./coordigent.js").main(process.argv.slice(2), process.env, "coord");

package/bin/coordigent.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-// The npm launcher: `npx coordigent <args>` or `npm i -g` and `coordigent <args>`.
+// The npm launcher: `npx coordigent <args>`, or after `npm i -g coordigent`, `coord <args>`,
+// `coord-mcp <args>` and `coordigent <args>`.
 //
 // It ships no binaries. On first run it downloads coord and coord-mcp for this
 // machine from the server's /install/<artifact>, checks each against the SHA-256
@@ -8,18 +9,29 @@
 // and on every later run, it runs `coord <args>`. Because the binaries live where
 // the installers put them, `coord update` and every MCP config keep working.
 //
+// `coordigent mcp [args]` runs coord-mcp instead: the stdio MCP server, for an MCP
+// client configured with `npx -y coordigent mcp` (the MCP Registry's npm entry,
+// server.json). Its stdout is the MCP channel, so the launcher writes only to stderr.
+//
+// The package's `coord` and `coord-mcp` bins are bin/coord.js and bin/coord-mcp.js, which
+// call main() here with the binary fixed. Separate files, not a check of the name this was
+// invoked as: on Windows npm's .cmd shim runs `node <bin file>`, so the file is all that
+// says which command was typed.
+//
 // Plain Node with no dependencies and no install scripts: the download happens at
 // run time, so `npm i --ignore-scripts` installs a working launcher.
 "use strict";
 
 const { spawn, execFileSync } = require("node:child_process");
 const { createHash } = require("node:crypto");
-const { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } = require("node:fs");
 const { homedir } = require("node:os");
-const { join } = require("node:path");
+const { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } = require("node:fs");
+const { join, dirname } = require("node:path");
 
 const HOSTED_SERVER_URL = "https://coordigent.com";
 const BINARIES = ["coord", "coord-mcp"];
+/** The first argument that runs coord-mcp rather than coord. coord has no `mcp` command. */
+const MCP_MODE = "mcp";
 
 /** A failure the person can act on: printed as one message, exit 1, no stack. */
 class LauncherError extends Error {}
@@ -133,7 +145,7 @@ function downloadFailure(response, url, platform) {
     return new LauncherError(`could not download ${url}\nWindows build not available yet.`);
   }
   return new LauncherError(
-    `could not download ${url} (HTTP ${response.status})\nThe server may not be publishing binaries. See docs/operations.md.`
+    `could not download ${url} (HTTP ${response.status})\nThe server may not be publishing binaries. See https://coordigent.com/docs/get-started/install.`
   );
 }
 
@@ -187,13 +199,36 @@ function rememberServer(env, server) {
   writeFileSync(config, `{\n  "serverUrl": "${server}"\n}\n`, { mode: 0o600, flag: "wx" });
 }
 
-function run(coord, args) {
-  const child = spawn(coord, args, { stdio: "inherit" });
+/**
+ * Which binary to run, and what to pass it. The `coord` and `coord-mcp` bins fix the binary and
+ * pass every argument through. `coordigent` reads it from the arguments: `mcp …` is coord-mcp,
+ * anything else coord.
+ */
+function resolveCommand(args, fixed) {
+  if (BINARIES.includes(fixed)) return { name: fixed, args };
+  return args[0] === MCP_MODE ? { name: "coord-mcp", args: args.slice(1) } : { name: "coord", args };
+}
+
+/**
+ * True when `target` is one of this package's own bins rather than a binary: what npm leaves in
+ * ~/.tower/bin when its global prefix is ~/.tower. Running it would start this launcher again,
+ * forever.
+ */
+function isLauncherItself(target) {
+  try {
+    return dirname(realpathSync(target)) === realpathSync(__dirname);
+  } catch {
+    return false;
+  }
+}
+
+function run(binary, args) {
+  const child = spawn(binary, args, { stdio: "inherit" });
   // Ctrl-C reaches coord from the terminal already; stay alive until it exits.
   process.on("SIGINT", () => {});
   for (const signal of ["SIGTERM", "SIGHUP"]) process.on(signal, () => child.kill(signal));
   child.on("error", (error) => {
-    process.stderr.write(`coordigent: could not run ${coord}: ${error.message}\n`);
+    process.stderr.write(`coordigent: could not run ${binary}: ${error.message}\n`);
     process.exit(1);
   });
   child.on("exit", (code, signal) => {
@@ -205,14 +240,22 @@ function run(coord, args) {
   });
 }
 
-async function main(args = process.argv.slice(2), env = process.env) {
+/** `fixed` is "coord" or "coord-mcp" from those bins; absent for `coordigent`. */
+async function main(args = process.argv.slice(2), env = process.env, fixed = undefined) {
   const log = (line) => process.stderr.write(`${line}\n`);
   try {
     const binDir = resolveBinDir(env);
     // The platform is resolved before anything is fetched or written, like install.sh.
     const platform = resolvePlatform();
     const suffix = exeSuffix(platform);
-    const coord = join(binDir, `coord${suffix}`);
+    const command = resolveCommand(args, fixed);
+    const binary = join(binDir, `${command.name}${suffix}`);
+    if (isLauncherItself(binary)) {
+      throw new LauncherError(
+        `${binary} is this npm launcher, not the ${command.name} binary: npm's global prefix is the folder\n` +
+          "the binaries go in. Install with another npm prefix, or set TOWER_BIN_DIR to another folder."
+      );
+    }
     if (!BINARIES.every((name) => existsSync(join(binDir, `${name}${suffix}`)))) {
       const server = resolveServer(env);
       await install({ server, binDir, platform, fetchImpl: fetch, log });
@@ -222,7 +265,7 @@ async function main(args = process.argv.slice(2), env = process.env) {
         // Optional, as in install.sh: coord login records the server too.
       }
     }
-    run(coord, args);
+    run(binary, command.args);
   } catch (error) {
     if (!(error instanceof LauncherError)) throw error;
     log(`coordigent: ${error.message}`);
@@ -230,6 +273,6 @@ async function main(args = process.argv.slice(2), env = process.env) {
   }
 }
 
-module.exports = { resolvePlatform, resolveServer, resolveBinDir };
+module.exports = { main, resolvePlatform, resolveServer, resolveBinDir, resolveCommand };
 
 if (require.main === module) main();

package/package.json

@@ -1,17 +1,34 @@
 {
   "name": "coordigent",
-  "version": "0.1.0",
-  "description": "Runs Coordigent's coord CLI: downloads the coord and coord-mcp binaries for this machine on first run, checks their SHA-256, and runs coord.",
+  "version": "0.1.3",
+  "description": "Coordigent's coord and coord-mcp commands: downloads the binaries for this machine on first run, checks their SHA-256, and runs them. `npx coordigent` and `npx coordigent mcp` work too.",
   "homepage": "https://coordigent.com",
+  "license": "MIT",
+  "mcpName": "com.coordigent/coordigent",
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "coding-agents",
+    "multi-agent",
+    "claude-code",
+    "codex",
+    "cursor",
+    "coordination",
+    "developer-tools"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/startupproj/coordigent.git",
     "directory": "packaging/npm"
   },
   "bin": {
+    "coord": "bin/coord.js",
+    "coord-mcp": "bin/coord-mcp.js",
     "coordigent": "bin/coordigent.js"
   },
   "files": [
+    "bin/coord.js",
+    "bin/coord-mcp.js",
     "bin/coordigent.js"
   ],
   "engines": {